CVE-2024-37148: GLPI-Project GLPI

High severity, CVSS 8.1. EPSS: 20.2% chance of exploitation in the next 30 days.

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrade to 10.0.16.

Affected products

• GLPI-Project GLPI: from 0.84, before 10.0.16 (fixed in 10.0.16)

Published 2024-07-10. Last modified 2026-06-17.